CVE-2026-94278None▾ SunlitThe File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored site data that referenced the old file path.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-1609High· 8.1A flaw was found in Keycloak
CVE-2026-105692Medium· 5.4Penpot is an open-source design and prototyping platform
CVE-2026-105389Medium· 6.3A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0
CVE-2026-105635High· 7.4Plane is an open-source project management tool
CVE-2026-103085Medium· 6.5Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20.
CVE-2026-105632High· 8.7Plane is an open-source project management tool